FILE FINDER SEARCH BOX

1abcln

I opened File Finder and in the search box the following was already typed in:c:\Archivos de Programa\sys_KI\Sys_Kl.exe

I didn't type this in where did it come from

How could this happen

I've done several searched but can't find any info on c:\Archivos de Programa\sys_KI\Sys_Kl.exe

However, Kl.exe comes up as a keylogger!

tullik

1ABCLN wrote
... I didn't type this in where did it come from How could this happen ... !

If you did not type it, it is certain someone else using your computer did.

And one of the "Automatic preference saving" options in the "Settings... Preference saving" tab is checked.

1abcln

tullik wrote
1ABCLN wrote ... I didn't type this in where did it come from How could this happen ... !

If you did not type it, it is certain someone else using your computer did.

And one of the "Automatic preference saving" options in the "Settings... Preference saving" tab is checked.

There is no one here to use my computer.

I'm becoming a little more concerned about this; while i couln'd find any information about c:\Archivos de Programa\sys_KI\Sys_Kl.exe a search for Kl.exe lead me to the following:

W32.Klexe.Worm contains two components, ecmsetup1.exe and kl.exe at norton antivirus. Several scans using Norton anti virus, Windows Defender, Spybot and Rootkit reaveler didn't show anything. So could a worm use JV16?!!!

lashiec

How did you do the search? Search for "Sys_Kl.exe", the first result on Google leads to a Symantec page. Read it. The program is a keylogger. It's very recent according to the page. Check if your Norton definitions are updated. If they're not, and you can't update them, then try give it a try to Trend Micro House call online antivirus. The strange thing is how the "File Finder" ended having such search on the box...

tullik

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

1abcln

Lashiec:

I thought I did the following searches:

Archivos de Programa\sys_KI\Sys_Kl.exe

Archivos de Programa

sys_KI\Sys_Kl.exe

Sys_Kl.exe

I must be mistaken. In any case I read the Symantec page regarding Spyware.SysKeylog.

Per the "Removal Instructions"

"3. To delete the value from the registry" I didn't find any of the subkeys listed in the registry.

When this first happened (06/18/06) I searched the registry for Archivos de Programa and all of the same items listed above and found nothing.

When the web search for Kl.exe resulted in the Symantec W32.Klexe.Worm, I shut down System Restore, update Norton Definitions (which showed all were up to date) and did a full scan nothing showed up and the results were the same for the Windows Defender, Spybot and Rootkit Reaveler scans. I also ran MS Malicious Software and Removal Tool it also reported nothing.

Tullik:

I down loaded jv16PT Power Tools around the first of the year and have used File Finder on several occasions. I don't remember ever having seen anything but an empty

search box upon opening File Finder; however I have found that it will save the last item typed into the search box.

I have something else to report that I don’t think is related but, a few days ago I noticed upon opening JV16 that the Tool Icon order had changed and still is from the way it had been for months. Any thoughts?

As to Archivos de Programa\sys_KI\Sys_Kl.exe could this operate for a fixed time and then uninstall itself?

Is there anything else I should do?

I will try the Trend Micro House call online antivirus.

And again why/how did Archivos de Programa\sys_KI\Sys_Kl.exe appear in the File Finder search box.

Thanks to all!

tullik

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

1abcln

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

tullik

PC Anywhere (and the ilk) -- As I understand it, once you install it, you can see and operate your desktop from "any" computer with web access. If you don't have it, then that would not be a path for someone to type into the File Finder window. :)

I have a second computer linked to the net via a wireless network but not networked to main computer.

Really? And how secure is your wireless network ... I regularly xcopy files (including PT Settings) to two other computers on the home network for backup.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Sage? Don't know. Maybe your poltergeist likes sage ... :

Given the above would it be prudent to conclude that Spyware.SysKeylog was not sucessful implimented on my computer?

I think you either forgot something or had a houseguest that didn't tell you everything.

indecline

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

tullik

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

1abcln

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

tullik

1ABCLN wrote
... If Spyware.SysKeylog had been installed on my computer and then shut down upon restart Norton AV should have detected it?

That would depend on the Norton virus definitions present on your computer at the time.

I only use yahoo for email would this prevent it from sending info out?

No.

If this had been sucessfully installed in a manner to escape detection from Norton AV, MS Defender, and Spybot and latter removed would there be any evidence (indirect or otherwise) left behind (excluding finding my back account closed next time i go on line)?

This question is a catch-22 (if it was undetectable, then I presume evidence left behind (if any) would also be undetectible) -- I have no answer.

indecline

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

jepe

Sorry, may I have missed something in Tullik's answers?

Could you just show up the part of Tullik's answer, where he is promoting or advertising this software.

I just could read the simple question if this software is installed on the incriminated PC to in-/exclude this possible way of the infection - nothingmore.

Jean-Paul

tullik

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.